CVE-2020-6808

2020-03-2521:13:32

mozilla

www.cve.org

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.1%

JSON

When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document’s URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "74",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]